Who we are
ROMbug Onion is an onion-routed web browser published by ROMbug, based in Vermont, United States. In this policy, “we” and “us” mean ROMbug, and “the app” means ROMbug Onion.
This policy explains what personal data we handle, why, and what choices you have. It applies to the app and to this website.
What we collect
ROMbug Onion is a one-time purchase, so there is very little to hold. We collect what we need to sell you a licence and support it.
| What | Why we have it | How long |
|---|---|---|
| Email address | To send your licence key, your download link and your receipt, and to re-issue the key if you lose it. | Up to 24 months after purchase, for support and accounting. |
| Licence key | To confirm the copy you are running was bought. | Same as above. |
| Payment records | Held by Stripe, our payment processor. We can see that a payment succeeded and the last four digits of the card; we never receive the full card number. | As required by tax and accounting law. |
| Server logs | Our licensing server records requests (IP address, time, and the endpoint called) to keep the service running and to detect abuse. | Rotated automatically, typically within 30 days. |
What we do not collect
- Your browsing history. The app keeps its own profile in a folder on your computer so the browser works. That folder never leaves your machine and we cannot read it.
- Anything about your circuits. The relays your traffic uses, the exit country, the sites you open — none of it is reported to us. The circuit view in the app is built locally from your own connection.
- Analytics or telemetry. The app contains no usage tracking, advertising identifiers, or third-party analytics.
- Search terms. No search engine is bundled and none is pre-selected. Whatever you choose in Settings, you deal with directly.
The onion network
ROMbug Onion routes your traffic through the Tor network: a public, volunteer-operated system of relays that we neither own nor run. We are not in the path of your traffic, and there is nothing about your browsing for us to log, sell or hand over.
Because the relays are run by strangers, the trust model is different from a VPN. It does not require you to trust any one of them. The first relay knows your address but not your destination; the last knows your destination but not your address. Only someone who could watch both ends at once could join them up.
Who else is involved
We use a small number of services to run the product. Each receives only what it needs.
| Service | What it handles |
|---|---|
| Stripe | The one-time payment. Stripe holds your card details; we do not. |
| Our email provider | Sends your licence key and download link. Receives your email address only. |
| Our hosting provider | Runs this website and the server that issues and checks licence keys. |
There is no VPN partner and no infrastructure partner carrying your traffic, because your traffic does not come to us.
We do not sell personal data, and we do not share it for advertising. We will disclose data if we are legally required to do so, and only to the extent required.
Your choices
Seeing or deleting your data
Write to support@rombugearth.com and we will tell you what we hold about you, correct it, or delete it. We will respond within 30 days.
Deleting your record means we can no longer re-issue your licence key if you lose it. The software you have already installed keeps working. We may keep payment records where tax law requires it.
Deleting what's on your computer
Uninstalling the app removes the program. Your Onion profile folder — history, cookies, settings — can be deleted from within the app at any time, or by removing the folder yourself. Nothing of it was ever ours.
If you are in California, the EU or the UK
You have rights to access, correct, delete and port your data, and to object to certain processing. We apply these rights to everyone, wherever you live, rather than only where the law compels it. We do not sell or share personal information as those terms are defined under California law.
Security
Licence data is held on a hosted server with encrypted connections. Card details never reach our systems.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by Vermont law and any other law that applies to you.
Children
ROMbug Onion is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has provided us with personal information, please contact us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will email everyone whose address we hold before it takes effect.
Contact
ROMbug
150 Dorset Street, STE 245, PMB #217
South Burlington, VT 05403
United States